org-standards

SUSPICIOUS. The skill’s repo-scanning and PR workflow match its stated purpose, and GitHub data flows go through the official gh CLI. The main issue is install/execution trust: core behavior relies on a local helper script and /setup-scripts regeneration path whose provenance is not verifiable from the provided evidence, creating a high supply-chain risk despite otherwise coherent purpose and data flows.